Getting Data In
Highlighted

Would I be able to rename a "Source Type" after the data got already indexed into Splunk?

Communicator

Would I be able to rename a "Source Type" after the data got already indexed into Splunk?

Can I rename a type of pattern data into another "Souce Type"

or

I have to delete the type of source and reindex?

Tags (1)
Highlighted

Re: Would I be able to rename a "Source Type" after the data got already indexed into Splunk?

Splunk Employee
Splunk Employee

You Cannot rename a Source Type after it has already been indexed. However, you can use tags or aliases to alter the way you identify those events:

http://www.splunk.com/base/Documentation/latest/Knowledge/Abouttagsandaliases

Re: Would I be able to rename a "Source Type" after the data got already indexed into Splunk?

Splunk Employee
Splunk Employee

In addition, you can make splunk treat sourcetype A as if it were sourcetype B for search purposes.

http://www.splunk.com/base/Documentation/4.1.2/Admin/Renamesourcetypes

This only allows you to cause ALL of sourcetype A to now be considered B.